SignedMailValidator now compares the certificate and From addresses lower cased in ASCII only, independently of the default locale, incorporating github PR #2485.

Author: rootvector2

CONTRIBUTORS.md

@@ -532,7 +532,7 @@ We also wish to acknowledge financial and collaborative support from [CISCO](htt
 - subbudvk \<https://github.com/subbudvk\> - initial author on S2K parser hardening work for OpenPGP API.
 - mkarasik \<https://github.com/mkarasik\> - initial work on EST server-side key generation (RFC 7030 4.4).
 - Bernd Prünster (A-SIT Plus) \<bernd.pruenster&#064;a-sit.at\> - reported lenient ASN.1 UTCTime/GeneralizedTime parsing accepting structurally malformed content, with fuzzing-derived test cases. Additional fuzzing around date validity as well.
-- Naveed Khan \<https://github.com/rootvector2\> - constant time comparison of membership and confirmation tags in the MLS API. Reported unbounded array allocation in the BKS/UBER keystore load path (OutOfMemoryError DoS from a crafted keystore) and introduction of a capped decompression limit in PGPCompressedData.getDataStream(), both with POC. Original submission creating S/MIME backing temp files with owner-only permissions (PR #2326). Rejecting empty sequences in the X.509 extension parsers whose RFC 5280 syntax is SEQUENCE SIZE (1..MAX) - CRLDistPoint, CertificatePolicies, ExtendedKeyUsage, PolicyMappings, and SubjectDirectoryAttributes (PR #2331). Hardening asn1.cms.SignerInfo decode to reject a non-INTEGER version or non-tagged unsignedAttrs via getInstance rather than leaking a ClassCastException (PR #2342). Fixing an off-by-4 header-length guard in the OpenPGP NotationData signature subpacket parser (PR #2346). Rejecting CR/LF in the S/MIME streaming writer header names and values (SMIMEEnvelopedWriter/SMIMESignedWriter withHeader) to prevent MIME header injection (PR #2348). Adding minimum-length guards to the SM2 decrypt and GOST28147/DSTU7624/DESede/RC2 key-wrap unwrap paths (PR #2359). Guarding the ECDH session-key length in the JCE OpenPGP decryptor (PR #2383). Fixing the identity fast-path type guards in the OER getInstance factories and the transposed isInstance arguments in OEROptional.getObject (PR #2373). Requiring the signature handed to AIMerSigner.verifySignature to be exactly the parameter set's signature size (PR #2401). Constant time comparison of the SRP-6a evidence messages (PR #2406). Surfacing a malformed TSTInfo in a time-stamp token as TSPException rather than an unchecked exception out of the TimeStampResponse constructors (PR #2415). Rejecting a PKCS#12 PBMAC1 KDF keyLength below the RFC 9579 sec. 9 floor of 20 octets (PR #2431). Initial implementation of the empty-label guard on name-constraint host matching, having found that the canonicalisation removed only one RFC 1034 root-label dot, so a dNSName, rfc822Name host or URI host carrying more than one matched no constraint at all (PR #2436). Initial implementation of the lookup of indirect CRL entries by issuer and serial number, having found that the certification path validators compared only the issuer of the first entry carrying a certificate's serial number (PR #2464). Initial implementation of the malformed-input handling of the OCSPResp and OCSPReq parsers (PR #2468). Rejecting short sequences in the CMS content-type decoders SignedData, EnvelopedData, AuthenticatedData, AuthEnvelopedData and EncryptedData (PR #2469). Finding the Hashtable.contains() guard on the CMS algorithm protection attribute in the signed and authenticated attribute table generators (PR #2480).
+- Naveed Khan \<https://github.com/rootvector2\> - constant time comparison of membership and confirmation tags in the MLS API. Reported unbounded array allocation in the BKS/UBER keystore load path (OutOfMemoryError DoS from a crafted keystore) and introduction of a capped decompression limit in PGPCompressedData.getDataStream(), both with POC. Original submission creating S/MIME backing temp files with owner-only permissions (PR #2326). Rejecting empty sequences in the X.509 extension parsers whose RFC 5280 syntax is SEQUENCE SIZE (1..MAX) - CRLDistPoint, CertificatePolicies, ExtendedKeyUsage, PolicyMappings, and SubjectDirectoryAttributes (PR #2331). Hardening asn1.cms.SignerInfo decode to reject a non-INTEGER version or non-tagged unsignedAttrs via getInstance rather than leaking a ClassCastException (PR #2342). Fixing an off-by-4 header-length guard in the OpenPGP NotationData signature subpacket parser (PR #2346). Rejecting CR/LF in the S/MIME streaming writer header names and values (SMIMEEnvelopedWriter/SMIMESignedWriter withHeader) to prevent MIME header injection (PR #2348). Adding minimum-length guards to the SM2 decrypt and GOST28147/DSTU7624/DESede/RC2 key-wrap unwrap paths (PR #2359). Guarding the ECDH session-key length in the JCE OpenPGP decryptor (PR #2383). Fixing the identity fast-path type guards in the OER getInstance factories and the transposed isInstance arguments in OEROptional.getObject (PR #2373). Requiring the signature handed to AIMerSigner.verifySignature to be exactly the parameter set's signature size (PR #2401). Constant time comparison of the SRP-6a evidence messages (PR #2406). Surfacing a malformed TSTInfo in a time-stamp token as TSPException rather than an unchecked exception out of the TimeStampResponse constructors (PR #2415). Rejecting a PKCS#12 PBMAC1 KDF keyLength below the RFC 9579 sec. 9 floor of 20 octets (PR #2431). Initial implementation of the empty-label guard on name-constraint host matching, having found that the canonicalisation removed only one RFC 1034 root-label dot, so a dNSName, rfc822Name host or URI host carrying more than one matched no constraint at all (PR #2436). Initial implementation of the lookup of indirect CRL entries by issuer and serial number, having found that the certification path validators compared only the issuer of the first entry carrying a certificate's serial number (PR #2464). Initial implementation of the malformed-input handling of the OCSPResp and OCSPReq parsers (PR #2468). Rejecting short sequences in the CMS content-type decoders SignedData, EnvelopedData, AuthenticatedData, AuthEnvelopedData and EncryptedData (PR #2469). Finding the Hashtable.contains() guard on the CMS algorithm protection attribute in the signed and authenticated attribute table generators (PR #2480). Locale-independent address folding in SignedMailValidator (PR #2485).
 - suraj0208 \<https://github.com/suraj0208\> - initial work on auto-detecting private key reader (JcaPrivateKeyReader).
 - liamgilligan \<https://github.com/liamgilligan\> - noticing the BIP-340 step numbering in the BIP340Signer signing comments was incorrect (PR #2340).
 - digi-scrypt \<https://github.com/digi-scrypt\> - disabling DTD and external-entity resolution in KMIPInputStream to close an XXE (local file disclosure / SSRF) exposure in KMIP XML parsing (PR #2315).

docs/releasenotes.md

@@ -85,6 +85,7 @@ Date: 2026, TBD
 
 - The jdk1.4 and jdk1.3 providers registered the PKCS12-AES256-AES128, PKCS12-AES256-AES128-GCM, PKCS12-DEF-AES256-AES128 and PKCS12-DEF-AES256-AES128-GCM KeyStores against classes those distributions do not contain. They are no longer registered there; the legacy PKCS12 stores can still read PBES2/AES protected files.
 - The OCSPResp(byte[]) and OCSPReq(byte[]) constructors reported a malformed encoding only when the ASN.1 decode raised IllegalArgumentException, ClassCastException or ASN1Exception, so a top-level SEQUENCE that is empty or truncated - which makes OCSPResponse/OCSPRequest read seq.getObjectAt(0) out of bounds - escaped the declared IOException as an ArrayIndexOutOfBoundsException. Both parsers now surface any RuntimeException from the decode as a CertIOException, as X509CertificateHolder and X509CRLHolder already do, so an OCSP client parsing a response and an OCSP responder parsing a request reject malformed input through the contract rather than crashing. The cause was in the ASN.1 types, which read fixed positions of their SEQUENCE without checking its size: OCSPResponse, OCSPRequest, BasicOCSPResponse, ResponseData, TBSRequest and Request now reject a short one with IllegalArgumentException, as SingleResponse and CertID already did. The OCSP ASN.1 types also cast their elements rather than passing them to getInstance(), so an element of the wrong type surfaced as a ClassCastException and a signature BIT STRING in a legal encoding other than DER was refused; they now use getInstance() throughout, and BasicOCSPResponse and Signature accept any BIT STRING encoding. The provider's OCSP revocation checking parses these types directly and let an unchecked exception out of CertPathValidator.validate() for a response that would not decode, whether stapled by the caller or returned by the responder; a stapled one is now rejected with a CertPathValidatorException, and a fetched one is treated as an unreachable responder is, so the check can fall back to CRLs. A successful response carrying no response bytes, which failed with a NullPointerException, is rejected the same way.
+- SignedMailValidator lower cased the signer certificate's email addresses and the message's From addresses with the default locale captured when the class was loaded, so on a Turkish or Azerbaijani locale, where 'I' lower cases to the dotless 'i' (U+0131), a correctly signed message from a mailbox written with an upper case I was reported as SignedMailValidator.emailFromCertMismatch. Lower casing with any locale also mapped some non-ASCII characters in a UTF8String or BMPString emailAddress attribute onto ASCII letters - U+212A KELVIN SIGN onto 'k', for example - so a certificate could match a From address it was not issued for. Both sides of the comparison are now lower cased in ASCII only, independently of the locale (PR #2485).
 
 - TLS: A TLS 1.3 client rejected every server certificate whose TLS feature extension (RFC 7633) listed status_request ("must-staple") whenever it had offered status_request itself, since the feature was looked for only in EncryptedExtensions, where RFC 8446 does not permit it; TLS 1.3 carries the OCSP response in the end-entity certificate's CertificateEntry. A feature is now also satisfied by the extensions of that CertificateEntry, and a feature whose extension has no place in TLS 1.3, such as status_request_v2, is no longer enforced once TLS 1.3 is negotiated (github #2458).
 - (D)TLS: A server certificate whose TLS feature extension listed status_request or status_request_v2 was accepted without any OCSP response for it when the server acknowledged the status request but then sent no CertificateStatus message, which RFC 6066 permits, or sent an ocsp_multi list with no response for the end-entity certificate. Such a certificate now requires a stapled OCSP response for the end-entity certificate, in every protocol version. A TLS feature in force against a (D)TLS 1.2 ServerHello that carried no extensions at all now fails with a certificate_unknown alert rather than a NullPointerException.

mail/src/main/java/org/bouncycastle/mail/smime/validator/SignedMailValidator.java

@@ -24,7 +24,6 @@
 import java.util.Iterator;
 import java.util.LinkedHashSet;
 import java.util.List;
-import java.util.Locale;
 import java.util.Map;
 import java.util.Set;
 
@@ -67,6 +66,7 @@
 import org.bouncycastle.pkix.util.filter.TrustedInput;
 import org.bouncycastle.pkix.util.filter.UntrustedInput;
 import org.bouncycastle.util.Integers;
+import org.bouncycastle.util.Strings;
 
 public class SignedMailValidator
 {
@@ -84,8 +84,6 @@ public class SignedMailValidator
     private static final int KU_DIGITAL_SIGNATURE = 0;
     private static final int KU_NON_REPUDIATION = 1;
 
-    private static final Locale locale = Locale.getDefault();
-
     private CertStore certs;
 
     private SignerInformationStore signers;
@@ -423,7 +421,7 @@ public static Set getEmailAddresses(X509Certificate cert) throws IOException, Ce
             {
                 if (PKCSObjectIdentifiers.pkcs_9_at_emailAddress.equals(atVs[j].getType()))
                 {
-                    String email = ((ASN1String)atVs[j].getValue()).getString().toLowerCase(locale);
+                    String email = Strings.toLowerCase(((ASN1String)atVs[j].getValue()).getString());
                     addresses.add(email);
                 }
             }
@@ -440,7 +438,7 @@ public static Set getEmailAddresses(X509Certificate cert) throws IOException, Ce
                 GeneralName name = names[i];
                 if (name.getTagNo() == GeneralName.rfc822Name)
                 {
-                    String email = ASN1IA5String.getInstance(name.getName()).getString().toLowerCase(locale);
+                    String email = Strings.toLowerCase(ASN1IA5String.getInstance(name.getName()).getString());
                     addresses.add(email);
                 }
             }
@@ -542,7 +540,7 @@ static boolean hasAnyFromAddress(Set certEmails, String[] fromAddresses)
         // check if email in cert is equal to the from address in the message
         for (int i = 0; i < fromAddresses.length; ++i)
         {
-            if (certEmails.contains(fromAddresses[i].toLowerCase(locale)))
+            if (certEmails.contains(Strings.toLowerCase(fromAddresses[i])))
             {
                 return true;
             }

mail/src/test/java/org/bouncycastle/mail/smime/test/SignedMailValidatorTest.java

@@ -39,11 +39,14 @@
 import org.bouncycastle.asn1.ASN1EncodableVector;
 import org.bouncycastle.asn1.ASN1Encoding;
 import org.bouncycastle.asn1.DERSet;
+import org.bouncycastle.asn1.DERUTF8String;
 import org.bouncycastle.asn1.cms.Attribute;
 import org.bouncycastle.asn1.cms.AttributeTable;
 import org.bouncycastle.asn1.cms.CMSAttributes;
 import org.bouncycastle.asn1.cms.Time;
 import org.bouncycastle.asn1.x500.X500Name;
+import org.bouncycastle.asn1.x500.X500NameBuilder;
+import org.bouncycastle.asn1.x500.style.BCStyle;
 import org.bouncycastle.asn1.x509.BasicConstraints;
 import org.bouncycastle.asn1.x509.Extension;
 import org.bouncycastle.asn1.x509.ExtendedKeyUsage;
@@ -164,6 +167,101 @@ public void testMultiEmail() throws Exception
         assertTrue(addresses.contains("domain-confidentiality-authority@bekb.ch "));
     }
 
+    public void testEmailAddressFoldingIsLocaleIndependent() throws Exception
+    {
+        // Turkish rules fold 'I' to the dotless U+0131; the class used to capture the default locale at load time.
+        Locale defaultLocale = Locale.getDefault();
+
+        try
+        {
+            Locale.setDefault(new Locale("tr", "TR"));
+
+            X500Name signDN = new X500Name("CN=Ian Echidna, E=IAN@EXAMPLE.ORG, O=Bouncy Castle, C=AU");
+
+            assertTrue("From address must match the certificate address whatever the default locale",
+                validateEmailBinding(signDN, "ian@example.org").isValidSignature());
+        }
+        finally
+        {
+            Locale.setDefault(defaultLocale);
+        }
+    }
+
+    public void testEmailAddressFoldingIsAsciiOnly() throws Exception
+    {
+        // U+212A KELVIN SIGN lower cases to 'k', U+0130 to 'i' (Turkish) or "i̇", so neither may match an ASCII mailbox.
+        checkNonAsciiEmailRejected("Kate@example.org", "kate@example.org");
+        checkNonAsciiEmailRejected("İan@example.org", "ian@example.org");
+    }
+
+    private void checkNonAsciiEmailRejected(String certEmail, String fromEmail) throws Exception
+    {
+        X500NameBuilder nameBuilder = new X500NameBuilder(BCStyle.INSTANCE);
+        nameBuilder.addRDN(BCStyle.CN, "Test Signer");
+        nameBuilder.addRDN(BCStyle.EmailAddress, new DERUTF8String(certEmail));
+        nameBuilder.addRDN(BCStyle.O, "Bouncy Castle");
+        nameBuilder.addRDN(BCStyle.C, "AU");
+
+        SignedMailValidator.ValidationResult result = validateEmailBinding(nameBuilder.build(), fromEmail);
+
+        assertTrue(result.isVerifiedSignature());
+        assertFalse(result.isValidSignature());
+
+        Iterator it = result.getErrors().iterator();
+        boolean found = false;
+        while (it.hasNext())
+        {
+            if (((ErrorBundle)it.next()).getId().equals("SignedMailValidator.emailFromCertMismatch"))
+            {
+                found = true;
+            }
+        }
+        assertTrue("expected emailFromCertMismatch for " + fromEmail, found);
+    }
+
+    private static SignedMailValidator.ValidationResult validateEmailBinding(X500Name signDN, String from)
+        throws Exception
+    {
+        long now = System.currentTimeMillis();
+        long day = 1000L * 60 * 60 * 24;
+        Date notBefore = new Date(now - day);
+        Date notAfter = new Date(now + 100 * day);
+
+        X500Name caDN = new X500Name("CN=Test CA, O=Bouncy Castle, C=AU");
+
+        KeyPair caKP = CMSTestUtil.makeKeyPair();
+        KeyPair signKP = CMSTestUtil.makeKeyPair();
+
+        X509Certificate caCert = buildCert(caDN, caKP.getPublic(), caDN, caKP, notBefore, notAfter, true);
+        X509Certificate signCert = buildCert(signDN, signKP.getPublic(), caDN, caKP, notBefore, notAfter, false);
+
+        List certList = new ArrayList();
+        certList.add(signCert);
+        certList.add(caCert);
+
+        SMIMESignedGenerator gen = new SMIMESignedGenerator();
+        gen.addSignerInfoGenerator(new JcaSimpleSignerInfoGeneratorBuilder().setProvider("BC")
+            .build("SHA256withRSA", signKP.getPrivate(), signCert));
+        gen.addCertificates(new JcaCertStore(certList));
+
+        MimeMultipart signedMsg = gen.generate(SMIMETestUtil.makeMimeBodyPart("Hello world!\n"));
+
+        Session session = Session.getDefaultInstance(System.getProperties(), null);
+        MimeMessage msg = new MimeMessage(session);
+        msg.setFrom(new InternetAddress(from));
+        msg.setRecipient(Message.RecipientType.TO, new InternetAddress("example@bouncycastle.org"));
+        msg.setContent(signedMsg, signedMsg.getContentType());
+        msg.saveChanges();
+
+        Set trust = new HashSet();
+        trust.add(new TrustAnchor(caCert, null));
+
+        PKIXParameters params = new PKIXParameters(trust);
+        params.setRevocationEnabled(false);
+
+        return firstResult(new SignedMailValidator(msg, params));
+    }
+
     public void testExtKeyUsage() throws Exception
     {
         String message = "validator.extKeyUsage.eml";
@@ -343,8 +441,15 @@ private static X509Certificate buildCert(String subDN, java.security.PublicKey s
         KeyPair issKP, Date notBefore, Date notAfter, boolean ca)
         throws Exception
     {
-        JcaX509v3CertificateBuilder b = new JcaX509v3CertificateBuilder(new X500Name(issDN),
-            BigInteger.valueOf(System.nanoTime()), notBefore, notAfter, new X500Name(subDN), subPub);
+        return buildCert(new X500Name(subDN), subPub, new X500Name(issDN), issKP, notBefore, notAfter, ca);
+    }
+
+    private static X509Certificate buildCert(X500Name subDN, java.security.PublicKey subPub, X500Name issDN,
+        KeyPair issKP, Date notBefore, Date notAfter, boolean ca)
+        throws Exception
+    {
+        JcaX509v3CertificateBuilder b = new JcaX509v3CertificateBuilder(issDN,
+            BigInteger.valueOf(System.nanoTime()), notBefore, notAfter, subDN, subPub);
         b.addExtension(Extension.basicConstraints, false, new BasicConstraints(ca));
         if (ca)
         {